UK Data (Use and Access) Act 2025: What Changes and How to Comply

Last updated: 22 October 2026

Quick answer: The Data (Use and Access) Act 2025 (DUAA) received Royal Assent on 19 June 2025 and amends, rather than replaces, the UK GDPR, the Data Protection Act 2018 and PECR. Its main data protection changes include recognised legitimate interests, a more permissive regime for automated decision-making, “reasonable and proportionate” DSAR searches, new cookie exemptions, PECR fines aligned with UK GDPR levels and a new duty to handle data protection complaints, which applied from 19 June 2026. To comply, update your privacy notices, lawful basis records, DSAR procedures, cookie banner and complaints process.

The DUAA is the UK’s first substantial reform of its data protection framework since leaving the EU. It is not a new GDPR. Most of your existing programme still applies: the principles, lawful bases, data subject rights, breach reporting and accountability duties remain in place.

What changes is the detail. Some obligations become more flexible, some new ones appear, and the regulator itself is being restructured. Organisations that operate in both the UK and the EU now have to manage a wider gap between the two regimes.

This guide explains what the DUAA is, how it was brought into force, the changes that matter most to controllers, how the ICO is becoming the Information Commission, and a practical checklist of what to update.

What is the Data (Use and Access) Act 2025?

The Data (Use and Access) Act 2025 is a broad piece of legislation covering data protection, privacy and electronic communications, and wider data policy. It received Royal Assent on 19 June 2025.

It has two broad halves:

• Data access and data use measures: a framework for “smart data” schemes (extending the open banking model to other sectors), rules for digital verification services, and provisions on public sector data such as the National Underground Asset Register.
• Data protection and privacy reforms: amendments to the UK GDPR, the Data Protection Act 2018 (DPA 2018) and the Privacy and Electronic Communications Regulations 2003 (PECR), plus the restructuring of the ICO into the Information Commission.

For most compliance teams the second half is what matters day to day. Smart data schemes only apply once regulations are made for a particular sector.

When did the DUAA come into force?

The Act was not switched on in one go. The government brought it into force in stages through commencement regulations over roughly the year after Royal Assent. The main changes to the UK GDPR and DPA 2018 were commenced in early 2026, and the new complaints duty for controllers applied from 19 June 2026, one year after Royal Assent.

Because commencement was phased, check that a specific provision is in force before relying on it.

What changes does the DUAA make to UK GDPR?

The table summarises the changes most compliance leads need to act on.

For a fuller view of where UK law now departs from the EU text, see our guide to UK GDPR vs EU GDPR differences.

What are recognised legitimate interests?

Recognised legitimate interests are a new lawful basis in Article 6(1)(ea) of the UK GDPR. They cover a short, fixed list of purposes set out in a new Annex 1. For these purposes the controller does not have to carry out the usual balancing test between its interests and the individual’s rights.

The listed purposes are:

• disclosures to a public body that says it needs the data for its public task;
• national security, public security and defence;
• responding to emergencies;
• detecting, investigating or preventing crime, or apprehending or prosecuting offenders;
• safeguarding vulnerable individuals.

Three points are often misunderstood:

1. Necessity still applies. The processing must still be necessary for the listed purpose. Removing the balancing test does not remove the need to justify why the data is needed.
2. Direct marketing is not a recognised legitimate interest. The Act adds examples of activities that may be legitimate interests, namely direct marketing, intra-group transfers for internal administration and ensuring network and information security. These remain ordinary legitimate interests and still need a legitimate interests assessment (LIA) with a balancing test.
3. Public authorities are limited. Public authorities still cannot rely on legitimate interests for processing carried out in performance of their tasks.

In practice, review your lawful basis for each processing activity in your record of processing activities (RoPA). Where a recognised legitimate interest genuinely fits, record which Annex 1 condition you rely on and why the processing is necessary, then update the privacy notice. Keep your existing LIAs for everything else.

How does the DUAA change automated decision-making?

The old Article 22 has been replaced by new Articles 22A to 22D. Under the previous rule, solely automated decisions with legal or similarly significant effects were generally prohibited unless an exception applied. The DUAA reverses that starting point for most personal data.

• Ordinary personal data: significant decisions based solely on automated processing are permitted under any lawful basis, provided safeguards are in place.
• Special category data: tighter restrictions remain. Such decisions are only allowed with explicit consent or where they are necessary for a contract or required or authorised by law and there is a substantial public interest condition.

The required safeguards are that individuals are told about significant decisions made about them, can make representations, can obtain human intervention and can contest the decision. “Human intervention” means meaningful review by someone with authority to change the outcome, not a rubber stamp.

If you use AI or scoring models in recruitment, credit, insurance, fraud detection or eligibility decisions, build an inventory of where solely automated decisions occur, document the safeguards for each, and test that the review route works. A DPIA remains the right tool for assessing high-risk automated processing.

What changes for subject access requests?

The right of access itself is unchanged: individuals can still request a copy of their personal data, and the usual one-month deadline (extendable by up to two further months for complex or numerous requests) still applies. The DUAA codifies several points that were previously guidance or case law.

• Reasonable and proportionate searches. Controllers are only required to carry out reasonable and proportionate searches for the requested information. This does not permit a minimal search, but gives a clearer footing for limiting disproportionate ones.
• Stopping the clock. Where a controller reasonably needs more information to identify the data or the request, such as clarification of a very broad request, the time limit pauses until the individual responds. The clock also starts only once the controller has received any information it needs to confirm identity.
• Refusals. The grounds for refusing or charging for a request remain “manifestly unfounded or excessive”. A proposal in the earlier, abandoned Data Protection and Digital Information Bill to move to a “vexatious or excessive” test was not carried into the DUAA.

Update your DSAR procedure to record the scope of each search and the reasoning behind it, and to log when the clock was paused and restarted. Our guides on DSAR response times in the UK, EU and US and proportionate DSAR identity verification cover the operational detail.

What changes for scientific research?

The DUAA adds a definition of scientific research to the UK GDPR. It covers processing that can reasonably be described as scientific, whether publicly or privately funded and whether carried out as a commercial or non-commercial activity. This gives commercial research and development a clearer footing.

Related changes include:

• Broad consent: consent can be given to an area of scientific research where it is not possible to fully identify the purposes at the outset, provided it is consistent with recognised ethical standards.
• Further processing: reuse of data for research, archiving or statistical purposes is treated as compatible with the original purpose, subject to appropriate safeguards.
• Transparency: there is a limited exemption from providing privacy information where data was collected directly and providing it for research reuse would involve disproportionate effort.

If you rely on these provisions, document why the activity qualifies as scientific research and the safeguards in place, such as pseudonymisation and access controls.

What changes for cookies and PECR?

The DUAA makes two changes to PECR that affect almost every organisation with a website.

New cookie consent exemptions

Consent is no longer required for certain low-risk storage and access technologies, provided users are given clear information and, for some purposes, a simple way to object. The exempt categories include:

• strictly necessary purposes, now spelled out to include security, fraud prevention and fault detection;
• collecting information for statistical purposes to improve a website or service, such as first-party analytics;
• adapting a website’s appearance or functionality to a user’s preferences;
• locating a user in an emergency.

Advertising and cross-site tracking cookies still need consent. Do not assume every analytics tool qualifies: check what data it collects, whether it is shared with the vendor for its own purposes, and whether users can easily opt out.

Higher PECR fines

Maximum PECR penalties now align with the UK GDPR: up to £17.5 million or 4% of annual worldwide turnover, whichever is higher. Previously PECR fines were capped at £500,000. This makes unlawful marketing and cookie practices a much more serious financial risk.

The DUAA also extends the “soft opt-in” for electronic marketing to charities, allowing them to email or text supporters who have expressed interest, subject to the usual opt-out conditions.

How do international transfers work after the DUAA?

The DUAA rewrites Chapter 5 of the UK GDPR around a single “data protection test”. A transfer is acceptable if the standard of protection in the destination country, or provided by the safeguards used, is not materially lower than in the UK. The test does not require the destination to have identical or equivalent law.

• The Secretary of State makes UK adequacy decisions (now called approved countries) by regulations, applying the same test.
• Controllers relying on safeguards such as the IDTA or the UK Addendum to the EU standard contractual clauses must apply the test acting reasonably and proportionately, taking into account the nature and volume of the data.

Existing transfer mechanisms continue to work. Review your transfer risk assessments so they are framed around the new test and kept on file. Our UK IDTA guide explains the contractual options.

What is the new complaints duty?

From 19 June 2026, controllers must have a process for handling complaints from individuals about the use of their personal data. The duty is set out in a new section 164A of the DPA 2018. Controllers must:

1. Facilitate complaints, for example by providing a complaint form that can be completed electronically, while still allowing other means.
2. Acknowledge each complaint within 30 days of receiving it.
3. Take appropriate steps to respond without undue delay, including making enquiries into the subject matter and keeping the complainant informed of progress.
4. Inform the complainant of the outcome without undue delay.

This sits alongside the individual’s right to complain to the regulator. The Act gives the regulator more scope to decline complaints that have not first been raised with the controller, so your own process becomes the first line of resolution.

A workable complaints process usually includes a published route (a web form and an email address), a register with timestamps for receipt, acknowledgement and closure, an owner for each complaint, and a link to related records such as DSARs or incidents. If a complaint reveals a personal data breach, your ICO breach reporting process and its 72-hour clock apply in parallel.

Is the ICO becoming the Information Commission?

Yes. The DUAA abolishes the office of the Information Commissioner and replaces it with the Information Commission, a body corporate with a board, a chair and a chief executive. The change is structural: the regulator moves from a single office-holder model to a board model, closer to other UK regulators.

The transfer takes effect on a date set by regulations. Until then the ICO continues to operate under its existing name, and existing guidance, codes and enforcement remain valid. Check the ICO website for the current status rather than relying on a fixed date.

The Act also changes how the regulator works:

• New duties: when carrying out its functions it must have regard to matters including innovation, competition and the protection of children.
• New investigative powers: it can compel individuals to attend interviews and require organisations to commission technical reports from approved persons, in addition to existing information and assessment notices.

The practical message is unchanged: be able to produce your RoPA, DPIAs, policies, complaints log and evidence quickly and in a consistent form. The ICO Accountability Framework remains a useful structure for organising that evidence.

Are there other changes to watch?

• Children’s higher protection matters: providers of online services likely to be accessed by children must take account of children’s higher protection matters when deciding on appropriate measures under data protection by design.
• EU adequacy: the EU’s adequacy decisions for the UK are reviewed by the European Commission. UK–EU data flows depend on the UK regime remaining adequate, so organisations with EU operations should keep an eye on that assessment.

DUAA compliance checklist: what should you update?

1. Confirm commencement status. List the DUAA provisions you plan to rely on and confirm each is in force.
2. Review lawful bases in your RoPA. Identify any activities that fit a recognised legitimate interest, record the Annex 1 condition and necessity reasoning, and keep LIAs for direct marketing, intra-group and security processing.
3. Update privacy notices. Reflect new lawful bases, automated decision-making safeguards, research reuse and the new complaints route.
4. Map automated decisions. Inventory solely automated significant decisions, confirm special category data restrictions, and document how individuals can make representations, obtain human intervention and contest decisions.
5. Revise your DSAR procedure. Record search scope and proportionality reasoning, log clock pauses for clarification and identity checks, and update response templates.
6. Stand up the complaints process. Publish an electronic complaint form, set a 30-day acknowledgement control, assign owners and keep a complaints register.
7. Re-audit your cookie banner. Classify each cookie and tag against the new exemptions, keep consent for advertising and tracking, add clear information and opt-outs for analytics, and update the cookie policy.
8. Review marketing compliance. With PECR fines raised, check consent records, suppression lists and soft opt-in use.
9. Refresh transfer assessments. Reframe transfer risk assessments around the “not materially lower” test.
10. Separate UK and EU rules. Where you operate in both, record which regime applies to each activity so UK-only flexibilities are not applied to EU processing.
11. Prepare for regulator inquiries. Make sure evidence, policies and logs can be produced quickly, and update regulator references when the Information Commission is established.

Enactia supports UK GDPR alongside EU GDPR in its cross-framework Compliance Universe, with modules for RoPA, DPIAs, data subject requests, incident and breach management, vendor and transfer management, and policy management. For a wider comparison of tools, see our guide to GRC software for UK organisations.

Frequently asked questions

Does the DUAA replace the UK GDPR?
No. The DUAA amends the UK GDPR, the Data Protection Act 2018 and PECR. The core principles, lawful bases, data subject rights and accountability duties remain, so existing compliance work carries over.

When did controllers need a complaints process under the DUAA?
From 19 June 2026. Controllers must facilitate complaints, for example with an electronic form, acknowledge them within 30 days, respond without undue delay and tell the complainant the outcome.

Is direct marketing a recognised legitimate interest?
No. Direct marketing is listed as an example of processing that may be carried out for legitimate interests, but it still needs a balancing test. Recognised legitimate interests cover a fixed list of purposes such as crime prevention, emergencies, safeguarding and national security. PECR consent rules for electronic marketing also still apply.

Can I refuse a DSAR as vexatious under the DUAA?
No. The test for refusing or charging for a request remains “manifestly unfounded or excessive”. The DUAA does confirm that searches need only be reasonable and proportionate, and lets the clock pause while you wait for clarification you reasonably need.

Do I still need a cookie banner?
In most cases, yes. The DUAA exempts some low-risk purposes, such as certain analytics and preference cookies, from consent, but advertising and tracking technologies still need consent. You must still give clear information about exempt cookies.

When does the ICO become the Information Commission?
On a date set by regulations under the DUAA. Until that happens the ICO continues to operate, and its guidance and enforcement remain in effect. Check the ICO website for the current status.

Bringing your UK programme up to date

The DUAA rewards organisations that already have good records. If your RoPA, DSAR log, transfer assessments and cookie inventory are current, most updates are targeted changes rather than a rebuild. Start with the public-facing items: the complaints process and cookie banner.

For help organising your UK data protection programme, contact us or book a demo or start your 14-day free trial.

This article is for general information and is not legal advice.